Penetration testing for online stores
Most stores lose money in quieter ways than a headline breach, like an order total changed in the browser or a script on the payment page that copies card numbers. We test checkout, accounts, payments and admin the way someone trying to profit from them would.
What we test in a store
Your platform secures its own servers. Custom themes, apps, integrations and headless storefronts are yours to secure, and that is where most store flaws live.
| Area | What we try to break |
|---|---|
| Checkout and pricing | Price and quantity tampering, discount and gift card abuse, negative totals, and race conditions that let one voucher be spent twice. |
| Customer accounts | Account takeover through login, password reset and session flaws, and whether one customer can see another customer's orders, addresses or invoices. |
| Payment pages | Script injection on checkout pages, the attack behind card skimming, and the script and change-detection controls PCI DSS now asks for (requirements 6.4.3 and 11.6.1). |
| Admin and staff panels | Exposed admin logins, staff roles that can do more than they should, and order or refund actions open to the wrong users. |
| APIs, apps and integrations | Storefront and mobile app APIs, payment gateway callbacks and webhooks, and connections to ERP, shipping and marketing tools. |
PCI DSS and your store
PCI DSS v4 requires internal and external penetration tests at least once a year and after significant changes, covering the systems in your cardholder data environment (requirement 11.4). Hosted checkouts shrink that scope a lot, but they do not remove it: the pages that send customers to the payment form are still your responsibility.
Quarterly external vulnerability scans are a separate requirement and must be run by a PCI-approved scanning vendor (ASV). A penetration test does not replace them. For practical steps beyond PCI, see testing for compliance.
How we test without hurting sales
- Staging first, when it mirrors production
- Payment gateways in test mode, so no real orders or charges
- Agreed testing windows away from your busy hours
- Critical issues reported as soon as we confirm them
- A retest after your fixes, with an updated report
Related reading
Web application testing
Customer portals, dashboards and online stores, tested against the OWASP Top 10.
API penetration testing
Storefront and partner APIs tested for broken authorization and data exposure.
What a test costs
The factors that set the price, and how we quote.
Store testing questions
Does my Shopify or hosted store need a penetration test?
The platform secures its own infrastructure, but custom apps, theme code, headless storefronts, integrations and your admin accounts are yours. If you have built anything custom around the store, it is worth testing.
Will testing place real orders?
No. We test with payment gateways in test mode, or on a staging copy of the store. Where a test must touch production, we agree what is allowed first and cancel anything we create.
Does a penetration test make us PCI compliant?
It covers one requirement. PCI DSS also needs quarterly ASV scans, documented policies and other controls. Our report is written so your assessor can use it as evidence for the penetration testing requirement.
How long does a store test take?
Most single stores take one to two weeks of testing, depending on custom features and integrations. Testing can start within 48 hours of a signed scope.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.